Close local Fabric service and TPM attestation gates

[rblake2320]

Scope

• installable/live-tested Fabric V2 Windows SCM service with direct ctypes IOCP completion handling
• machine-scoped non-exportable TPM identity key and nonce-bound PCR quote verification
• durable replay rejection, redacted evidence, packaging, runbooks, and bounded release claims

Verification

• 841 passed, 11 skipped
• hardware TPM suite: 5 passed
• package build and wheel-content inspection: passed
• release audit: 46 passed, 0 warnings/failures
• exact built commit installed system-wide; SCM service Automatic/Running; live ACK in 0.969 ms

Boundaries

• one-host mechanism evidence, not fleet deployment
• manufacturer/EK certificate-chain trust, remote enrollment/revocation, signed installer policy, independent assessment, and ATO remain external deployment gates
• Fabric V2 is not claimed as the default route for every SelfConnect workload